icedid | 19995a1dd05fd6d0479ccd9f268bf713a4e7d873a7c68c368343e59dd7b7cad6

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 06:53

Target

8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll
Size

214KB
MD5

8640a5f8e0a61fb9908e48ebd0084ebc
SHA1

5222e4b1507008ee4a58cabf9d5d42da84be825c
SHA256

19995a1dd05fd6d0479ccd9f268bf713a4e7d873a7c68c368343e59dd7b7cad6
SHA512

06dde8e24f006b55532e31faac8daaf7ac8c968934101c6c304183dfd6f1c3122889c75c8389def4cc6669e034f01aac87b9315b5699e58dde65d8f61df47376
SSDEEP

6144:54+U6Ou0hTIXJnxeecA9ikbl4yB6ETGzM0y:a+U6Oleh9cA/lV6ETGw0y

Score

10^/10

Family

icedid

ldrshekel.casa

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/1736-1-0x0000000074EA0000-0x0000000074F37000-memory.dmp	IcedidFirstLoader

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4352 1736 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4352	1736	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1736	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1736	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1736	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll,#1
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 596
    3⤵
    - Program crash
    PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1736 -ip 1736
1⤵
PID:1360

memory/1736-0-0x0000000074ED4000-0x0000000074ED8000-memory.dmp

Filesize
16KB

Download
memory/1736-1-0x0000000074EA0000-0x0000000074F37000-memory.dmp

Filesize
604KB

Download
memory/1736-2-0x0000000074ED4000-0x0000000074ED8000-memory.dmp

Filesize
16KB

Download
memory/1736-3-0x0000000074EA0000-0x0000000074F34000-memory.dmp

Filesize
592KB

Download